Microsoft Entra ID
The Microsoft Entra ID (formerly Azure AD) connector brings directory identities, group memberships, and sign-in signals into Axiad Mesh. As an identity-provider connector, it is typically the first connector you configure.
Prerequisites
- A Mesh administrator account with permission to manage connectors.
- An Entra ID tenant with the ability to register an application.
- Directory read and audit-log read permissions.
Authentication
Mesh authenticates as a registered application using the client-credentials flow:
- Register an application in Entra ID.
- Grant the required Microsoft Graph read permissions.
- Create a client secret and record the client ID and tenant (directory) ID.
Provide the client ID, tenant ID, and client secret in the connector configuration. Secret fields are write-only.
Capabilities
| Capability | Supported | Notes |
|---|---|---|
| User accounts | ✓ | |
| Groups & membership | ✓ | |
| Sign-in / audit logs | ✓ | Requires audit-log read scope |
| Writeback / remediation | — | Read-only in v1 |
Data model
The connector maps Entra ID users to Mesh identities, and groups/roles to entitlements, which the risk engines then evaluate.
Setup
- Complete Authentication above.
- In Admin → Connectors, add the Microsoft Entra ID connector.
- Enter the credentials and configure the collection schedule.
- Save and run an initial collection.
Troubleshooting
- Authentication failed — verify the client secret has not expired and the app has the required Graph permissions with admin consent granted.
- No sign-in data — confirm the audit-log read scope is present.